Outlook Word editor connects to suspicious site

[Kirk]

I'm a little suspicious that I may have an unknown virus or spyware.

I have Outlook XP and Word is configured as my editor for writing
messages. When I reply or write a new message, my firewall (I'm using
Sygate) warns me that winword.exe is trying to access 65.45.13.188
(www.imandd.com). So I told it No, and didn't let it go out. But
then Outlook will lock and I'll have to kill the process, including
the winword process. Outlook doesn't do it when I turn the word
editor off.

I figured I'd see what "imandd.com" is. I went there is it looks like
a bogus site of a company where you can't click on anything. I did a
whois search and also a google search. The whois came up with a fake
address and the google search came up with references to some motley
crue stuff. Do a search and you'll see.

Is this site just a pawn for some keylogger or spyware??? I don't
know.

This is a red flag!!! If winword connected to microsoft, it'd be
another story.

I have Spybot Search & Destroy, Adaware, and Norton AV all up to date
and scan my system often however they don't detect anything.

So I was just wondering if anyone would know why Outlook would try and
connect to this place via Word. If I run Word by itself, it doesn't
do this.

I have a feeling my system has some kind of virus or spyware that's
not detected. I tried to fish through the registry, yeah right.
Since I can't seem to find or scrub this, I'm about to wipe it and
reload everything (Ugh).

Anyone come across this?
Thanks,
Kirk

 

[Diane Poremsky [MVP]]

find and rename the normal.dot and see if it still happens.

 

[Kirk]

I gave it a shot. renamed it, deleted it, etc. Still tries to
connect to that same ip address.

find and rename the normal.dot and see if it still happens.

--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)

I'm a little suspicious that I may have an unknown virus or spyware.

I have Outlook XP and Word is configured as my editor for writing
messages. When I reply or write a new message, my firewall (I'm using
Sygate) warns me that winword.exe is trying to access 65.45.13.188
(www.imandd.com). So I told it No, and didn't let it go out. But
then Outlook will lock and I'll have to kill the process, including
the winword process. Outlook doesn't do it when I turn the word
editor off.

I figured I'd see what "imandd.com" is. I went there is it looks like
a bogus site of a company where you can't click on anything. I did a
whois search and also a google search. The whois came up with a fake
address and the google search came up with references to some motley
crue stuff. Do a search and you'll see.

Is this site just a pawn for some keylogger or spyware??? I don't
know.

This is a red flag!!! If winword connected to microsoft, it'd be
another story.

I have Spybot Search & Destroy, Adaware, and Norton AV all up to date
and scan my system often however they don't detect anything.

So I was just wondering if anyone would know why Outlook would try and
connect to this place via Word. If I run Word by itself, it doesn't
do this.

I have a feeling my system has some kind of virus or spyware that's
not detected. I tried to fish through the registry, yeah right.
Since I can't seem to find or scrub this, I'm about to wipe it and
reload everything (Ugh).

Anyone come across this?
Thanks,
Kirk

 

[Rob Schneider]

Do you get this when launching Word on it's own, or is this just
Outlook-with-Word-as-Editor problem?

Suggest you seek assistance from the Word experts in
microsoft.public.word.docmanagement and/or microsoft.public.outlook as
they may know the place where this could be "configured".

Hope this is useful to you. Let us know.

rms

I gave it a shot. renamed it, deleted it, etc. Still tries to
connect to that same ip address.

find and rename the normal.dot and see if it still happens.

--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)

I'm a little suspicious that I may have an unknown virus or spyware.

I have Outlook XP and Word is configured as my editor for writing
messages. When I reply or write a new message, my firewall (I'm using
Sygate) warns me that winword.exe is trying to access 65.45.13.188
(www.imandd.com). So I told it No, and didn't let it go out. But
then Outlook will lock and I'll have to kill the process, including
the winword process. Outlook doesn't do it when I turn the word
editor off.

I figured I'd see what "imandd.com" is. I went there is it looks like
a bogus site of a company where you can't click on anything. I did a
whois search and also a google search. The whois came up with a fake
address and the google search came up with references to some motley
crue stuff. Do a search and you'll see.

Is this site just a pawn for some keylogger or spyware??? I don't
know.

This is a red flag!!! If winword connected to microsoft, it'd be
another story.

I have Spybot Search & Destroy, Adaware, and Norton AV all up to date
and scan my system often however they don't detect anything.

So I was just wondering if anyone would know why Outlook would try and
connect to this place via Word. If I run Word by itself, it doesn't
do this.

I have a feeling my system has some kind of virus or spyware that's
not detected. I tried to fish through the registry, yeah right.
Since I can't seem to find or scrub this, I'm about to wipe it and
reload everything (Ugh).

Anyone come across this?
Thanks,
Kirk